Researchers Expose Hidden Alliances Between Ransomware Groups

Researchers are revealing a fractured ransomware ecosystem, where hidden connections and alliances bind what were once treated as discrete groups. A new collaborative map led by Jon DiMaggio at Analyst1, in partnership with Scylla Intel and the DomainTools Investigations Team, culminates in an infographic titled “A Visual and Analytical Map of Russian-affiliated Ransomware Groups,” showing how shared code, infrastructure overlaps, and operator migration thread through Conti, LockBit, Evil Corp, and other actors.

The research favours a networked view over traditional attribution, tracing overlaps through overlapping IPs, passive DNS records, TLS certificates, and common delivery vectors, and highlighting human operator drift as a key asset in modern operations. It also points to fragments shared between Black Basta and Qakbot, ongoing use of legacy Trickbot infrastructure, and widespread use of tools like AnyDesk and Quick Assist to illustrate standardised playbooks across groups.

According to DomainTools Investigations, the infographic offers a visual guide and strategic roadmap for understanding and countering these dynamic criminal ecosystems.